Functionality and Data Stealing by Pseudo-Client Attack and Target Defenses in Split Learning

Lan Zhang

doi:10.1109/TDSC.2024.3387396

Return

Functionality and Data Stealing by Pseudo-Client Attack and Target Defenses in Split Learning

2025-01-01

PRE

DOI：10.1109/TDSC.2024.3387396

Original

Original request for help

Save

Abstract

En 中文

Split learning (SL) aims to protect a client's data by splitting up a neural network among the client and the server. Previous efforts have shown that a semi-honest server can conduct a model inversion attack. However, those attacks require the knowledge of the client network structure, and the performance deteriorates dramatically as the client network gets deeper (>= 2 layers). In this work, we explore the attack in a more general and challenging situation where the client model is unknown and more complex. We unveil the inherent privacy leakage through a series of intermediate server models during SL, and propose a new attack on SL: Pseudo-Client ATtack (PCAT). To the best of our knowledge, this is the first attack for a semi-honest server to steal clients' functionality, reconstruct private inputs and labels without any knowledge about the clients' network structure. Moreover, the attack is transparent to clients. Extensive experiments demonstrate that our attack outperforms previous works in scenarios involving more complex models and learning tasks, even in non-i.i.d. settings and confronted with conventional defensive measures. We further explore novel defense mechanisms to mitigate PCAT and improve our attack to counteract the potential defenses.

Keywords:

Servers

Data models

Computational modeling

Task analysis

Training

Privacy

Machine learning

Privacy attacks

privacy defenses

split learning